What is the meaning of .ini file in startup folder?

Question

Now my windows 7 is too slow and crashing usually. I checked the start up folder. I get a file with extension .ini. The content of file is

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21769
IconResource=%SystemRoot%\system32\imageres.dll,-183

Is this dangerous?

Answer 1

This is a typical Desktop ini file that normally saves the folder view settings such as the background image etc. If suspect some malware is executing on the Windows startup, it might be executing from

1. Run and RunOnce keys in the registry
2. Windows Services
3. Windows drivers
4. DLL hijacking (placing itself in a path that comes before the legitimate DLL)
5. Registry key of the registered shell extensions
6. Hidden file or shortcut in the startup folder

There might be other locations as well so your best bet is quarentine the machine and follow the standard procedure of malware cleanup. You will find plenty of examples on how to cleanup a malware infected machine on SE and other forums.

Answer 2

Just to clarify since void_in's answer didn't say it directly. No, that file is perfectly normal and safe. INI files are just configuration files that are used to store settings. They can not be executed on their own, though some viruses can work by adding values to certain INI files to make a legitimate program do their dirty work. The contents of the INI file you have listed appear normal however.